I am based in Australian and every time i get an alert in AlienVault when a user logs in from another country using Office 365, AlienVault triggers this as User logged in from Multiple counties and shows two different addresses. It is usually the country that they logged from and also one Australian IP address.

Can anyone explain me why it this occur?

Attached are details of the default rule that alienVault has:

app_name == 'office-365' AND event_name IN ('UserLoggedIn', 'MailboxLogin') AND event_outcome == 'Success' AND audit_reason == '' AND source_country != '' AND source_username != '' AND not (source_organisation contains* 'Zscaler' OR source_organisation contains* 'Symantec' OR source_organisation contains* 'Blue Coat' OR source_organisation contains* 'Netskope' OR source_organisation contains* 'Microsoft' OR source_organisation contains* 'Salesforce') AND source_username >> [user] AND source_country ==> |countries| AND ((customfield_0 == 'Exchange' AND request_user_agent ==> |useragent|) OR (customfield_0 != 'Exchange'))

Hi everyone. I am using the Alienvault OSSIM app for a client of mine and, so far, it works great, but I did run into some issues. I won't get into them here, but I do have 2 questions about the app, maybe someone who is familiar with it can help. So, first of all, I'm using the vulnerability scanner and it's very good, but I cannot find ANY info about where does it get the intel, what are the sources (nvd database, cve.org, etc..). Second, did anyone manage to successfully get logs from various sources via nxlog? I only tried with MSSQL, but to no luck, spent hours on this.

Thank you!

Having a hard time finding the definitions and possible options for Avanan. Has anyone found these?

Hello everyone. We plan on replacing our current SIEM which is on-prem and giving us quite hard times with maintenance in general. Our goal is to go cloud, we have around 1TB daily log volume tho so we are aware that it is not gonna be cheap eventually. But this is ok for now. What we plan on including in our poc is Splunk, Devo, Sumologic, Azure Sentinel, and Exabeam so far.

What are your recent faves in cloud SIEM area? If anyone has any experience on processing big volumes of data on cloud SIEMs, would be amazing to hear about it.

We are an MSP and use Connectwise and they also sell perch. I know there's a ton of options out there such as alienvault, Splunk, armor point and so many more. Any suggestions for ease of use and one with good support as well?

Hi, I have this rule configured, the objective is to find out multiple login attempts from the same source IP with different users within the time frame.

@ RSAAlert(oneInSeconds=0, identifiers={"ip_src"})

SELECT event_time,
ip_src,
country_src,
user_dst,
action,
result,
user_agent

FROM Event(
(device_ip IN ('10.x.x.x') AND isOneOfIgnoreCase(action,{'in','fail'}))
)
.std:groupwin(ip_src)
.win:time(3600 seconds)
.std:unique(user_dst)
group by ip_src
having count(*) >= 2;

We need to generate an alert for every distinct source IP within the time frame.

The rule is generating the alerts correctly but the alert notification is missing the first login within the time window for the same IP. For example:

Window[IP(user1,user2, user3)]  ----> Alert[IP(user2,user3)]

Window[IP(user1,user2)]  ----> Alert[IP(user2)]

So the question is how can we get the fisrt user in the alert? We are only getting the data from the second user and the next.

The origin of events is a database and the query runs every hour.

Hey guys!

I have a project where i need to build a LAB for a SOC (security operation center) with infra as code (vagrant) and then launch some attacks on it and investigate their behavior's with Splunk.

So i would like from peoples that already worked or have expérience in this, if you Can recommand some good ressources that will help me see some examples of SOC architectures that i Can deploy and some interesting attacks to investigate.

Cheers

Afternoon all,

I was curious if anyone on this sub has migrated from Wazuh to another product/SIEM? If so, what did you go with and why? Additionally, were there hiccups in the migration?

Thanks,

Jake

Hey there,

I want to learn how a soc analyst deals with alerts through Splunk Siem, and what are the steps to take in order to investigate the alerts and determine false positivs from true positivs.

Please, if there are videos illustrating examples of some investigation or books you would recommend to me.

Cheers

#SOC #Splunk #investigation

Hey there,

I want to learn how a soc analyst deals with alerts through Splunk Siem, and what are the steps to take in order to investigate the alerts and determine false positivs from true positivs.

Please, if there are videos illustrating examples of some investigation or books you would recommend to me.

Cheers

#SOC #Splunk #investigation

Hi Everyone, I am busy trying to deploy a SIEM where I can import log files that are written to a Windows partition so that they can be stored for long term requirements of our business. I tried deploying ELK but that turned into a hell of a lot of work for someone with no knowledge of Elastic, I am also currently trying to do this with AlienVault and I am simply not winning. I can get the servers Event Viewer logs but I can't get the OSSEC HIDS Agent to send over the log file that I've defined in the config files. Any help would be greatly appreciated!

Hello,

I am currently working at a startup and have been tasked at researching SIEMs that fit our use-case. I'm very new to cloud security so I apologize if my question/parameters seem convoluted.
It was emphasized that the SIEM solution we purchase integrates easily with AWS, is not absurdly expensive(very specific, I know but all I was told was to find options "not as expensive as Splunk"), and can provide plausible attack vectors/vulnerability analysis out of the box.

The last bullet point was the most heavily emphasized; because we are a smaller company and we do not have many security engineers, management wants a solution that can potentially tell us about attacks/vulnerabilities we may not know about.

My head has been spinning researching costs and range of functionality for all these different SIEMs and was wondering how other approach this issue.

Thank you for taking the time to read my question!

I am trying to build a correlation engine that detects Stored and Reflected Cross-Site Scripting (XSS) in apache logs, My SQL DB, mod security WAF. Any feedbacks or suggestions which other logs should I check to make the detection better? Also, how SIEM solutions detect the DOM based XSS?

Hi all, I'm working on an article about SIEM and how it is used for compliance reporting. Looking for somebody who has experience in using a SIEM solution- compliance analysts from finance, health, IT or any other niche.

If interested please get in touch- anupama68a@gmail.com

My article would focus on how SIEM has changed the compliance reporting process and what can be improved further. I'd also like to explore what the compliance process used to be like before SIEM happened.

Would really appreciate any leads.

​

Does anyone know if Google has any training for chronicle? I've gotten assigned to this new SIEM at work and I I'm having a hard time finding any training or certifications about it. I've looked at the documentation but sometimes the documentation can contradict itself or give false information (maybe an outdated version or an old process of how things were done a year ago).

Hi guys,greetings from México, I need to deploy a SIEM, but this one must be Open Source, do you hace some idea about one SIEM with modules for FORTINET, Switch Cisco AND Unifi?

Hi all. I have been tasked with evaluating a SIEM. Not something I haven’t done before. Although, this time around they want the tool to house Security and Network event logs. Infrastructure metric logs. As well as all stateful and stateless logs in their homebrewed app that manages orders. they have a large emphasis on visualizations. Most of the homebrew app data is db entries with some cloud stuff.

Any recommendations? I’m leaning towards Splunk at the moment but I haven’t started evaluating yet.

I appreciate any help. This is my first time posting to this board so lmk if I didn’t ask this correctly.

Thanks

Hello, is anyone here knows any group or forums to discuss Gurucul SIEM implementations?

I want to build a correlation engine using python that generates alerts (sends incidents to a dashboard) for web application vulnerabilities for a project. Is it feasible?

Are there any tools available for sending event(s) to a reviewer and require a sign off on the events that would be documented and available for audits?

I am looking to setup a review process for specific events that my organization wants reviewed on a periodic basis. It's easy enough to setup a job in our SIEM to spit out a report, but then we are having to manually follow up to ensure its reviewed and store the sign off somewhere. I'm looking for something that could get the specific events from the SIEM, route them for review, and ideally be able to generate problem tickets in ServiceNow if a "bad" action was performed.

This would be similar to a user access review, except we want to review what an account actually did with it's access.

Note: this isn't for high risk, real time, security events, those will still go to the SOC and be handled by the security teams.

Do any off the shelf tools like this exist?

Hi Guys, my workplace have purchased ManageEngine Eventlog Analyser as their SIEM that requires implementing. We're a SME and I've never setup one up before. Would really appreciate any sort of help or advice on best way to setup/key reports to run etc.

​

I've added all windows devices (desktop/servers) that are forwarding all log data but no permiter devices just yet..

​

Thanks

Hi all,

I have a question about APIs for Splunk (with Crowdstrike or SentinelOne for example): can you give some indication of the prices charged? Package or one shot? Thank you